

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=&#34;auto&#34;>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/2.jpg">
  <link rel="icon" type="image/png" href="/img/2.jpg">
  <meta name="viewport"
        content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="description" content="">
  <meta name="author" content="K">
  <meta name="keywords" content="">
  <title>docker-overylay - K</title>

  <link  rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.staticfile.org/github-markdown-css/4.0.0/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.staticfile.org/highlight.js/10.0.0/styles/github-gist.min.css" />
    
  

  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
<meta name="generator" content="Hexo 5.2.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand"
       href="/">&nbsp;<strong>かい</strong>&nbsp;</a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" data-toggle="modal" data-target="#modalSearch">&nbsp;<i
                class="iconfont icon-search"></i>&nbsp;</a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" href="javascript:">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner intro-2" id="background" parallax=true
         style="background: url('/img/1.jpg') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="container page-header text-center fade-in-up">
            <span class="h2" id="subtitle">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2020-12-10 14:00" pubdate>
        2020年12月10日 下午
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      3.7k 字
    </span>
  

  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      59
       分钟
    </span>
  

  
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid">
  <div class="row">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-md">
      <div class="container nopadding-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto" id="post">
            <!-- SEO header -->
            <h1 style="display: none">docker-overylay</h1>
            
            <div class="markdown-body" id="post-body">
              <h2 id="overlay网络转发原理"><a href="#overlay网络转发原理" class="headerlink" title="overlay网络转发原理"></a>overlay网络转发原理</h2><p>  <img src="/images/docker/over.png" srcset="/img/loading.gif"></p>
<ul>
<li>创建好docker-overlay类型的容器后，docker会创建一个命名空间，里面会有一个br0网卡</li>
<li>而这个命名空间内veth0桥接着br0,它的作用是和容器的eth0进行veth pair连接通信，</li>
<li>这个命名空间内还有一个vxlan0网卡,它的作用是进行跨主机通信，只要两端的 命名空间内的 vxlan_id相同就可以通信</li>
<li>要相同的 id才能通信，那么就需要consul来同步两台docker主机的数据了，也就是说，只要有consul，其中一台docker创建一个块新的网卡，马上就会同步到，第二台主机中，两台主机的容器只要使用相同的网卡就能够进行通信了</li>
</ul>
<h2 id="准备overlay环境"><a href="#准备overlay环境" class="headerlink" title="准备overlay环境"></a>准备overlay环境</h2><ul>
<li><p>做之前，需要跨网络的其中一台主机需要下载consul镜像</p>
<blockquote>
<p>docker1主机下载镜像</p>
</blockquote>
<pre><code class="hljs autoit">[root<span class="hljs-symbol">@localhost</span> ~]<span class="hljs-meta"># docker pull progrium/consul</span>
</code></pre></li>
<li><p>因为consul在主机间传输数据依靠主机名来做，所以我们先改一下两台的主机名，以便区分</p>
<pre><code class="hljs autoit">[root<span class="hljs-symbol">@localhost</span> ~]<span class="hljs-meta"># hostname docker1</span>
[root<span class="hljs-symbol">@localhost</span> ~]<span class="hljs-meta"># bash</span>
[root<span class="hljs-symbol">@docker1</span> ~]<span class="hljs-meta">#</span>

<span class="hljs-meta"># docker2</span>
[root<span class="hljs-symbol">@localhost</span> ~]<span class="hljs-meta"># hostname docker2</span>
[root<span class="hljs-symbol">@localhost</span> ~]<span class="hljs-meta"># bash</span>
[root<span class="hljs-symbol">@docker2</span> ~]<span class="hljs-meta">#</span></code></pre>
</li>
<li><p>两台主机放行端口</p>
<blockquote>
<p>docker管理端口：2376/tcp 2376/udp<br>docker集群通信：2733/tcp 2733/udp<br>docker主机间通信：7946/tcp 7946/udp<br>docker overlay网络：4789/tcp 4789/udp</p>
</blockquote>
</li>
</ul>
<blockquote>
<p>两台主机放行端口,打开路由转发</p>
</blockquote>
<pre><code class="hljs ini"><span class="hljs-comment"># 两台docker都要放行</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --add-port=2733/tcp --permanent</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --add-port=2733/udp --permanent</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --add-port=2376/udp --permanent</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --add-port=2376/tcp --permanent</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --add-port=7946/tcp --permanent</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --add-port=7946/udp --permanent</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --add-port=4789/udp --permanent</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --add-port=4789/tcp --permanent</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --reload</span>
<span class="hljs-section">[root@docker1 ~]</span><span class="hljs-comment"># firewall-cmd --list-port</span>

<span class="hljs-section">[root@localhost ~]</span><span class="hljs-comment"># echo &#x27;net.ipv4.ip_forward = 1&#x27; &gt;&gt; /etc/sysctl.conf </span>
<span class="hljs-section">[root@localhost ~]</span><span class="hljs-comment"># sysctl -p</span>
<span class="hljs-attr">net.ipv4.ip_forward</span> = <span class="hljs-number">1</span>
</code></pre>
<blockquote>
<p>docker1运行consul</p>
</blockquote>
<pre><code class="hljs angelscript"><span class="hljs-string">[root@docker1 ~]</span># docker run -d --restart always -p <span class="hljs-number">8400</span>:<span class="hljs-number">8400</span> -p <span class="hljs-number">8500</span>:<span class="hljs-number">8500</span> \
-p <span class="hljs-number">8600</span>:<span class="hljs-number">53</span>/udp progrium/consul -server -bootstrap -ui-dir /ui
<span class="hljs-number">44</span>bd33f2b9911b86c0479efb6169c39090b0503c28b9ff2c7edd32bed4cc7586</code></pre>
<blockquote>
<p>consul加入docker启动文件，让docker加入到consul</p>
</blockquote>
<pre><code class="hljs awk">[root@docker1 ~]<span class="hljs-comment"># vim /usr/lib/systemd/system/docker.service</span>
ExecStart=<span class="hljs-regexp">/usr/</span>bin<span class="hljs-regexp">/dockerd -H fd:/</span><span class="hljs-regexp">/ -H tcp:/</span><span class="hljs-regexp">/0.0.0.0:2376 --containerd=/</span>run<span class="hljs-regexp">/containerd/</span>containerd.sock --cluster-store=consul:<span class="hljs-regexp">//</span><span class="hljs-number">192.168</span>.<span class="hljs-number">100.211</span>:<span class="hljs-number">8500</span> --cluster-advertise=ens33:<span class="hljs-number">2376</span>

<span class="hljs-comment">#--cluster-store 指定 consul 的地址。</span>
<span class="hljs-comment">#--cluster-advertise 告知 consul 自己的连接地址。</span></code></pre>
<blockquote>
<p>两台主机重启docker</p>
</blockquote>
<pre><code class="hljs autoit"><span class="hljs-meta"># docker1重启</span>
[root<span class="hljs-symbol">@docker1</span> ~]<span class="hljs-meta"># systemctl daemon-reload </span>
[root<span class="hljs-symbol">@docker1</span> ~]<span class="hljs-meta"># systemctl restart docker</span>

<span class="hljs-meta"># docker2重启</span>
[root<span class="hljs-symbol">@docker2</span> ~]<span class="hljs-meta"># systemctl daemon-reload </span>
[root<span class="hljs-symbol">@docker2</span> ~]<span class="hljs-meta"># systemctl restart docker</span>
</code></pre>
<ul>
<li>打开浏览器，访问<a target="_blank" rel="noopener" href="http://192.168.100.211:8500/">http://192.168.100.211:8500</a></li>
<li>找到以下两个节点，也就是docker1和docker2的ip:2376docker管理节点<br><img src="/images/docker/so.png" srcset="/img/loading.gif"></li>
</ul>
<h2 id="创建overlay网络"><a href="#创建overlay网络" class="headerlink" title="创建overlay网络"></a>创建overlay网络</h2><ul>
<li>需要先开启网卡的混杂模式<blockquote>
<p>docker1</p>
</blockquote>
<pre><code class="hljs routeros">[root@docker1 ~]# ifconfig ens33 promisc
[root@docker1 ~]#<span class="hljs-built_in"> ip </span>a  | grep PROMISC
2: ens33: &lt;BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP&gt;</code></pre>
<blockquote>
<p>创建overylay网络</p>
</blockquote>
<pre><code class="hljs routeros">[root@docker1 ~]# docker<span class="hljs-built_in"> network </span>create --driver overlay --attachable ov_net1
a921406c8f1e6c3899b39c3ecc862d806107f7abbab4f93e9b529896dd23b66d
<span class="hljs-comment"># 默认情况下overlay只能用于docker swarm集群环境，使用--attachable可以在集群之外单独使用</span></code></pre>
<blockquote>
<p>查看创建成功的overlay网络<br>这个网卡是基于global（全局范围），也就是所有添加过consul端口的docker服务器都会创建这块网卡了</p>
</blockquote>
<pre><code class="hljs routeros"><span class="hljs-comment"># docker1</span>
[root@docker1 ~]# docker<span class="hljs-built_in"> network </span>ls
NETWORK ID          NAME                DRIVER              SCOPE
49670536d26e       <span class="hljs-built_in"> bridge </span>            <span class="hljs-built_in"> bridge </span>             local
dc8bfdbda464        host                host                local
ecbab8a758e6        none                <span class="hljs-literal">null</span>                local
a921406c8f1e        ov_net1             overlay             global
<span class="hljs-comment"># docker2</span>
[root@docker2 ~]# docker<span class="hljs-built_in"> network </span>ls
NETWORK ID          NAME                DRIVER              SCOPE
b1240547891e       <span class="hljs-built_in"> bridge </span>            <span class="hljs-built_in"> bridge </span>             local
fb1387ab7fc3        host                host                local
a728ac0f7801        none                <span class="hljs-literal">null</span>                local
a921406c8f1e        ov_net1             overlay             global
</code></pre>
<blockquote>
<p>查看overlay的网络信息</p>
</blockquote>
<pre><code class="hljs routeros">[root@docker1 ~]# docker<span class="hljs-built_in"> network </span>inspect ov_net1 
                    <span class="hljs-string">&quot;Subnet&quot;</span>: <span class="hljs-string">&quot;10.0.0.0/24&quot;</span>,  # 网段
                    <span class="hljs-string">&quot;Gateway&quot;</span>: <span class="hljs-string">&quot;10.0.0.1&quot;</span>  # 网关</code></pre>

</li>
</ul>
<h2 id="使用overlay网络运行容器"><a href="#使用overlay网络运行容器" class="headerlink" title="使用overlay网络运行容器"></a>使用overlay网络运行容器</h2><blockquote>
<p>docker1</p>
</blockquote>
<pre><code class="hljs angelscript"><span class="hljs-string">[root@docker1 ~]</span># docker run -itd --name bbox1 --network ov_net1 busybox
d74c87e1bd18e1624207d162f75cce6c13892d86a2c13e41bfdc225602eefd23
<span class="hljs-string">[root@docker1 ~]</span># docker exec bbox1 ip a
<span class="hljs-number">1</span>: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu <span class="hljs-number">65536</span> qdisc noqueue qlen <span class="hljs-number">1000</span>
    link/loopback <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span> brd <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>
    inet <span class="hljs-number">127.0</span><span class="hljs-number">.0</span><span class="hljs-number">.1</span>/<span class="hljs-number">8</span> scope host lo
       valid_lft forever preferred_lft forever
<span class="hljs-number">47</span>: <span class="hljs-symbol">eth0@</span>if48: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1450</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:<span class="hljs-number">0</span>a:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">02</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">10.0</span><span class="hljs-number">.0</span><span class="hljs-number">.2</span>/<span class="hljs-number">24</span> brd <span class="hljs-number">10.0</span><span class="hljs-number">.0</span><span class="hljs-number">.255</span> scope global eth0
       valid_lft forever preferred_lft forever
<span class="hljs-number">50</span>: <span class="hljs-symbol">eth1@</span>if51: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1500</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:ac:<span class="hljs-number">12</span>:<span class="hljs-number">00</span>:<span class="hljs-number">02</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">172.18</span><span class="hljs-number">.0</span><span class="hljs-number">.2</span>/<span class="hljs-number">16</span> brd <span class="hljs-number">172.18</span><span class="hljs-number">.255</span><span class="hljs-number">.255</span> scope global eth1
       valid_lft forever preferred_lft forever</code></pre>
<ul>
<li>会发现这个容器上除了lo网络还有两块网卡，eth0是overlay的网络的网卡，eth1默认路由要去使用的网卡</li>
<li>这时候docker还会多出一块网卡docker_gwbridge，用来为所有的连接到overlay网络的容器提供了访问外网的能力<pre><code class="hljs routeros">[root@docker1 ~]# docker<span class="hljs-built_in"> network </span>ls
NETWORK ID          NAME                DRIVER              SCOPE
49670536d26e       <span class="hljs-built_in"> bridge </span>            <span class="hljs-built_in"> bridge </span>             local
da3b5eb55718        docker_gwbridge    <span class="hljs-built_in"> bridge </span>             local
dc8bfdbda464        host                host                local
ecbab8a758e6        none                <span class="hljs-literal">null</span>                local
a921406c8f1e        ov_net1             overlay             global</code></pre></li>
<li>查看该网卡网段，与使用overlay网络的容器中是同一个网段，他本身也是一个overlay的网络<pre><code class="hljs routeros">[root@docker1 ~]# docker<span class="hljs-built_in"> network </span>inspect docker_gwbridge
                   <span class="hljs-string">&quot;Subnet&quot;</span>: <span class="hljs-string">&quot;172.18.0.0/16&quot;</span>,
                   <span class="hljs-string">&quot;Gateway&quot;</span>: <span class="hljs-string">&quot;172.18.0.1&quot;</span></code></pre>
<blockquote>
<p>查看桥接网卡</p>
</blockquote>
</li>
<li>注意看，veth20a968a被桥接在docker_gwbridge网卡上<pre><code class="hljs routeros">[root@docker1 ~]#<span class="hljs-built_in"> ip </span>a
<span class="hljs-built_in">..</span>.
51: veth20a968a@if50: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker_gwbridge state UP<span class="hljs-built_in"> group default </span>
    link/ether ee:16:6e:72:93:e6 brd ff:ff:ff:ff:ff:ff link-netnsid 2
    inet6 fe80::ec16:6eff:fe72:93e6/64 scope link 
       valid_lft forever preferred_lft forever
[root@docker1 ~]# brctl show
bridge name<span class="hljs-built_in">	bridge </span>id		STP enabled	interfaces
docker0		8000.024217bee795	<span class="hljs-literal">no</span>		veth3ed4284
docker_gwbridge		8000.0242dbe46d3e	<span class="hljs-literal">no</span>		veth20a968a
virbr0		8000.525400d7704d	<span class="hljs-literal">yes</span>		virbr0-nic</code></pre></li>
<li>docker_gwbridge就是为容器连接外网的<pre><code class="hljs routeros"> [root@docker1 ~]# docker exec bbox1<span class="hljs-built_in"> ping </span>www.baidu.com
PING www.baidu.com (61.135.169.121): 56 data bytes
64 bytes <span class="hljs-keyword">from</span> 61.135.169.121: <span class="hljs-attribute">seq</span>=0 <span class="hljs-attribute">ttl</span>=127 <span class="hljs-attribute">time</span>=4.131 ms</code></pre></li>
<li>使用overlay网络的容器内映射端口也是没有问题的<pre><code class="hljs gherkin">[root<span class="hljs-meta">@docker1</span> ~]<span class="hljs-comment"># docker run -p 80:80 -d --network ov_net1 --name web1 httpd:latest</span>
6b60e837f2b9984b0b9c0ae6ffa88e97f0ece4b8628a9fa5f4a64af9204aed44
[root<span class="hljs-meta">@docker1</span> ~]<span class="hljs-comment"># curl 192.168.100.211</span>
<span class="hljs-variable">&lt;html&gt;</span><span class="hljs-variable">&lt;body&gt;</span><span class="hljs-variable">&lt;h1&gt;</span>It works!<span class="hljs-variable">&lt;/h1&gt;</span><span class="hljs-variable">&lt;/body&gt;</span><span class="hljs-variable">&lt;/html&gt;</span></code></pre>

</li>
</ul>
<h2 id="跨主机容器通信"><a href="#跨主机容器通信" class="headerlink" title="跨主机容器通信"></a>跨主机容器通信</h2><ul>
<li>要开启路由转发</li>
<li>上面在docker1已经运行一个容器，现在在docker2中运行容器<blockquote>
<p>docker2</p>
</blockquote>
<ul>
<li>使用overlay网络运行容器，并查看ip<pre><code class="hljs angelscript"><span class="hljs-string">[root@docker2 ~]</span># docker run -itd --name bbox2 --network on_net1 busybox
<span class="hljs-number">0723927f</span>22394709d4d0deb20bae90a728dfd144083d474d65e058ac8e6731b6

<span class="hljs-string">[root@docker2 ~]</span># docker exec bbox2 ip a
<span class="hljs-number">1</span>: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu <span class="hljs-number">65536</span> qdisc noqueue qlen <span class="hljs-number">1000</span>
    link/loopback <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span> brd <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>
    inet <span class="hljs-number">127.0</span><span class="hljs-number">.0</span><span class="hljs-number">.1</span>/<span class="hljs-number">8</span> scope host lo
       valid_lft forever preferred_lft forever
<span class="hljs-number">8</span>: <span class="hljs-symbol">eth0@</span>if9: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1450</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:<span class="hljs-number">0</span>a:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">04</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">10.0</span><span class="hljs-number">.0</span><span class="hljs-number">.4</span>/<span class="hljs-number">24</span> brd <span class="hljs-number">10.0</span><span class="hljs-number">.0</span><span class="hljs-number">.255</span> scope global eth0
       valid_lft forever preferred_lft forever
<span class="hljs-number">11</span>: <span class="hljs-symbol">eth1@</span>if12: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1500</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:ac:<span class="hljs-number">12</span>:<span class="hljs-number">00</span>:<span class="hljs-number">02</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">172.18</span><span class="hljs-number">.0</span><span class="hljs-number">.2</span>/<span class="hljs-number">16</span> brd <span class="hljs-number">172.18</span><span class="hljs-number">.255</span><span class="hljs-number">.255</span> scope global eth1
       valid_lft forever preferred_lft forever</code></pre></li>
<li>通过ip发现，与docker1中同样的网卡网段，这由consul统一的数据分配的</li>
<li>尝试与docker1的bbox1容器通信，成功~<pre><code class="hljs routeros">[root@docker2 ~]# docker exec bbox2<span class="hljs-built_in"> ping </span>-c 2 bbox1
PING bbox1 (10.0.0.2): 56 data bytes
64 bytes <span class="hljs-keyword">from</span> 10.0.0.2: <span class="hljs-attribute">seq</span>=0 <span class="hljs-attribute">ttl</span>=64 <span class="hljs-attribute">time</span>=0.739 ms
64 bytes <span class="hljs-keyword">from</span> 10.0.0.2: <span class="hljs-attribute">seq</span>=1 <span class="hljs-attribute">ttl</span>=64 <span class="hljs-attribute">time</span>=1.134 ms
 
--- bbox1<span class="hljs-built_in"> ping </span>statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.739/0.936/1.134 ms</code></pre></li>
</ul>
</li>
<li>所有在consul集群中同一overlay网络中的容器可以互相通信</li>
<li>docker 会为每个 overlay 网络创建一个独立的 network namespace<blockquote>
<p>docker网络的存放位置</p>
</blockquote>
<pre><code class="hljs angelscript"><span class="hljs-string">[root@docker1 ~]</span># cd /var/run/docker/netns/
<span class="hljs-string">[root@docker1 netns]</span># ll
total <span class="hljs-number">0</span>
-r--r--r--. <span class="hljs-number">1</span> root root <span class="hljs-number">0</span> Apr  <span class="hljs-number">2</span> <span class="hljs-number">22</span>:<span class="hljs-number">09</span> <span class="hljs-number">1</span>-a921406c8f
-r--r--r--. <span class="hljs-number">1</span> root root <span class="hljs-number">0</span> Apr  <span class="hljs-number">2</span> <span class="hljs-number">22</span>:<span class="hljs-number">22</span> <span class="hljs-number">244</span>cf69f028a
-r--r--r--. <span class="hljs-number">1</span> root root <span class="hljs-number">0</span> Apr  <span class="hljs-number">2</span> <span class="hljs-number">21</span>:<span class="hljs-number">43</span> <span class="hljs-number">663</span>ad80947aa
-r--r--r--. <span class="hljs-number">1</span> root root <span class="hljs-number">0</span> Apr  <span class="hljs-number">2</span> <span class="hljs-number">22</span>:<span class="hljs-number">09</span> e8cb0000018a
</code></pre></li>
<li>为了可让ip netns直接可以查看docker网络，做一个软链接<pre><code class="hljs awk"><span class="hljs-comment"># docker1 and docker2</span>
ln -s <span class="hljs-regexp">/var/</span>run<span class="hljs-regexp">/docker/</span>netns<span class="hljs-regexp">/ /</span>var<span class="hljs-regexp">/run/</span>netns</code></pre>
<blockquote>
<p>docker1</p>
</blockquote>
<pre><code class="hljs routeros">[root@docker1 ~]#<span class="hljs-built_in"> ip </span>netns
244cf69f028a (id: 3)
e8cb0000018a (id: 2)
1-a921406c8f (id: 1)
663ad80947aa (id: 0)</code></pre>
<blockquote>
<p>docker2</p>
</blockquote>
<pre><code class="hljs routeros">[root@docker2 ~]#<span class="hljs-built_in"> ip </span>netns
c8a0a325610f (id: 1)
1-a921406c8f (id: 0)</code></pre>
<ul>
<li>观察可以看到两台主机都有相同的网络1-a921406c8f，这就是两台主机所在的相同的网络命名空间，为什么说在同一个命名空间。<blockquote>
<p>docker1</p>
</blockquote>
<pre><code class="hljs angelscript"><span class="hljs-string">  [root@docker1 ~]</span># docker exec bbox1 ip a
<span class="hljs-number">1</span>: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu <span class="hljs-number">65536</span> qdisc noqueue qlen <span class="hljs-number">1000</span>
    link/loopback <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span> brd <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>
    inet <span class="hljs-number">127.0</span><span class="hljs-number">.0</span><span class="hljs-number">.1</span>/<span class="hljs-number">8</span> scope host lo
       valid_lft forever preferred_lft forever
<span class="hljs-number">47</span>: <span class="hljs-symbol">eth0@</span>if48: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1450</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:<span class="hljs-number">0</span>a:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">02</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">10.0</span><span class="hljs-number">.0</span><span class="hljs-number">.2</span>/<span class="hljs-number">24</span> brd <span class="hljs-number">10.0</span><span class="hljs-number">.0</span><span class="hljs-number">.255</span> scope global eth0
       valid_lft forever preferred_lft forever
<span class="hljs-number">50</span>: <span class="hljs-symbol">eth1@</span>if51: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1500</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:ac:<span class="hljs-number">12</span>:<span class="hljs-number">00</span>:<span class="hljs-number">02</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">172.18</span><span class="hljs-number">.0</span><span class="hljs-number">.2</span>/<span class="hljs-number">16</span> brd <span class="hljs-number">172.18</span><span class="hljs-number">.255</span><span class="hljs-number">.255</span> scope global eth1
       valid_lft forever preferred_lft forever</code></pre></li>
<li>使用的overlay网卡是47@48的，再看物理机中是否有这样的网卡(没有)</li>
<li>那这两块网卡就在另外一个网络命名空间范围<blockquote>
<p>进入ip netns查看到的相同命名空间可以看到如下</p>
</blockquote>
<pre><code class="hljs routeros">  [root@docker1 ~]#<span class="hljs-built_in"> ip </span>netns exec 1-a921406c8f<span class="hljs-built_in"> ip </span>a
1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN<span class="hljs-built_in"> group default </span>qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: br0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1450 qdisc noqueue state UP<span class="hljs-built_in"> group default </span>
    link/ether 46:1f:b7:ea:30:4e brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.1/24 brd 10.0.0.255 scope global br0
       valid_lft forever preferred_lft forever
46: vxlan0@if46: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1450 qdisc noqueue master br0 state UNKNOWN<span class="hljs-built_in"> group default </span>
    link/ether d6:9f:87:b1:84:32 brd ff:ff:ff:ff:ff:ff link-netnsid 0
48: veth0@if47: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1450 qdisc noqueue master br0 state UP<span class="hljs-built_in"> group default </span>
    link/ether 46:1f:b7:ea:30:4e brd ff:ff:ff:ff:ff:ff link-netnsid 1
53: veth1@if52: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1450 qdisc noqueue master br0 state UP<span class="hljs-built_in"> group default </span>
    link/ether 56:41:d1:39:8b:e8 brd ff:ff:ff:ff:ff:ff link-netnsid 2</code></pre></li>
<li>再来看47@48桥接在这个命名空间内br0的网卡上，可以看到上方br0也是10网段，还存在一个vxlan0</li>
<li>也就是说 vxlan0是跨主机通信的网卡，而veth0是访问外网的网卡，他们都桥接到br0上了<pre><code class="hljs routeros">[root@docker1 ~]#<span class="hljs-built_in"> ip </span>netns exec 1-a921406c8f brctl show
bridge name<span class="hljs-built_in">	bridge </span>id		STP enabled	interfaces
br0		8000.461fb7ea304e	<span class="hljs-literal">no</span>		veth0
							        veth1
							        vxlan0
</code></pre></li>
</ul>
</li>
<li>跨主机通讯的前提是两个容器内的vxlan的域id相同<pre><code class="hljs routeros">[root@docker1 ~]#<span class="hljs-built_in"> ip </span>netns exec 1-a921406c8f<span class="hljs-built_in"> ip </span>-d l show vxlan0
46: vxlan0@if46: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1450 qdisc noqueue master br0 state UNKNOWN mode<span class="hljs-built_in"> DEFAULT group default </span>
    link/ether d6:9f:87:b1:84:32 brd ff:ff:ff:ff:ff:ff link-netnsid 0 promiscuity 1 
    vxlan id 256 srcport 0 0 dstport 4789<span class="hljs-built_in"> proxy </span>l2miss l3miss ageing 300 noudpcsum noudp6zerocsumtx noudp6zerocsumrx</code></pre>
<ul>
<li>可以看到是256<br><img src="/images/docker/kzjyl.png" srcset="/img/loading.gif"></li>
<li>如图所示，在创建ov_net1的时候，两台主机都有了这个overlay网卡，当在1.12中使用ov_net1运行bbox1时，生成了47@48的overlay网络和50@51的与1.12物理机通信的网络，同时也生成了一个网络的命名空间（1-a921406c8f）。</li>
<li>在网络命名空间中，br网卡通过桥接veth0与bbox1的overlay网络相连，和桥接vxlan0实现跨主机通信</li>
<li>与此同时，1.13中的bbox2是同理，他们之间的互相通信，因为他们的网络命名空间的相同和vxlan id相同，进而可以进行通信</li>
</ul>
</li>
</ul>
<h2 id="overlay的隔离"><a href="#overlay的隔离" class="headerlink" title="overlay的隔离"></a>overlay的隔离</h2><ul>
<li><p>不同的 overlay 网络是相互隔离的。创建第二个overlay网络ov_net2来运行容器</p>
<blockquote>
<p>创建第二个overlay网络<br>docker1</p>
</blockquote>
<pre><code class="hljs routeros"> # 创建一个新网卡
 [root@docker1 ~]# docker<span class="hljs-built_in"> network </span>create --driver overlay ov_net2
e2ddd9d7d1a609576c217d685cf8eb7e95b7ba74742afce5c31b8c7a1f53b0b1
</code></pre>
<blockquote>
<p>运行容器</p>
</blockquote>
<pre><code class="hljs llvm">[root<span class="hljs-title">@docker1</span> ~]# docker run -itd --name bbox<span class="hljs-number">3</span> --network ov_net<span class="hljs-number">2</span> busybox
<span class="hljs-number">09</span>a<span class="hljs-number">1</span><span class="hljs-keyword">c</span><span class="hljs-number">1</span>a<span class="hljs-number">651</span>aa<span class="hljs-number">4</span>ffeb<span class="hljs-number">2</span>ee<span class="hljs-number">8885</span>f<span class="hljs-number">896</span><span class="hljs-keyword">c</span><span class="hljs-number">308</span>d<span class="hljs-number">4</span>a<span class="hljs-number">038</span>fd<span class="hljs-number">47011</span>ccfa<span class="hljs-number">3</span>dcaa<span class="hljs-number">623</span>d<span class="hljs-number">892</span>edb</code></pre>
<blockquote>
<p>查看bbox3容器ip</p>
</blockquote>
<pre><code class="hljs angelscript"><span class="hljs-string">[root@docker1 ~]</span># docker exec bbox3 ip a
<span class="hljs-number">1</span>: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu <span class="hljs-number">65536</span> qdisc noqueue qlen <span class="hljs-number">1000</span>
    link/loopback <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span> brd <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>
    inet <span class="hljs-number">127.0</span><span class="hljs-number">.0</span><span class="hljs-number">.1</span>/<span class="hljs-number">8</span> scope host lo
       valid_lft forever preferred_lft forever
<span class="hljs-number">14</span>: <span class="hljs-symbol">eth0@</span>if15: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1450</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:<span class="hljs-number">0</span>a:<span class="hljs-number">00</span>:<span class="hljs-number">01</span>:<span class="hljs-number">02</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">10.0</span><span class="hljs-number">.1</span><span class="hljs-number">.2</span>/<span class="hljs-number">24</span> brd <span class="hljs-number">10.0</span><span class="hljs-number">.1</span><span class="hljs-number">.255</span> scope global eth0
       valid_lft forever preferred_lft forever
<span class="hljs-number">16</span>: <span class="hljs-symbol">eth1@</span>if17: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1500</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:ac:<span class="hljs-number">12</span>:<span class="hljs-number">00</span>:<span class="hljs-number">03</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">172.18</span><span class="hljs-number">.0</span><span class="hljs-number">.3</span>/<span class="hljs-number">16</span> brd <span class="hljs-number">172.18</span><span class="hljs-number">.255</span><span class="hljs-number">.255</span> scope global eth1
       valid_lft forever preferred_lft forever</code></pre>
<blockquote>
<p>bbox3 ping bbox1 和 bbox2</p>
</blockquote>
<pre><code class="hljs routeros">[root@docker1 ~]# docker exec -it bbox3<span class="hljs-built_in"> ping </span>-c 2 bbox1
ping: bad<span class="hljs-built_in"> address </span><span class="hljs-string">&#x27;bbox1&#x27;</span>
[root@docker1 ~]# docker exec -it bbox3<span class="hljs-built_in"> ping </span>-c 2 bbox2
ping: bad<span class="hljs-built_in"> address </span><span class="hljs-string">&#x27;bbox2&#x27;</span></code></pre>

<h2 id="overlay跨网段通信"><a href="#overlay跨网段通信" class="headerlink" title="overlay跨网段通信"></a>overlay跨网段通信</h2><ul>
<li>接上面的bbox3</li>
<li>通过个 bbox3的容器添加 一个 ov_net1网卡<pre><code class="hljs routeros">[root@docker1 ~]# docker<span class="hljs-built_in"> network </span>connect ov_net1 bbox3  # 将ov_net1网络连接到bbox3的网络
[root@docker1 ~]# docker exec -it bbox3<span class="hljs-built_in"> ping </span>-c 2 bbox2
PING bbox2 (10.0.0.4): 56 data bytes
64 bytes <span class="hljs-keyword">from</span> 10.0.0.4: <span class="hljs-attribute">seq</span>=0 <span class="hljs-attribute">ttl</span>=64 <span class="hljs-attribute">time</span>=0.189 ms
--- bbox2<span class="hljs-built_in"> ping </span>statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.189/0.189/0.189 ms
[root@docker1 ~]# docker exec -it bbox3<span class="hljs-built_in"> ping </span>-c 2 bbox1
PING bbox1 (10.0.0.2): 56 data bytes
64 bytes <span class="hljs-keyword">from</span> 10.0.0.2: <span class="hljs-attribute">seq</span>=0 <span class="hljs-attribute">ttl</span>=64 <span class="hljs-attribute">time</span>=1.686 ms
64 bytes <span class="hljs-keyword">from</span> 10.0.0.2: <span class="hljs-attribute">seq</span>=1 <span class="hljs-attribute">ttl</span>=64 <span class="hljs-attribute">time</span>=1.411 ms
--- bbox1<span class="hljs-built_in"> ping </span>statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1.411/1.548/1.686 ms</code></pre>
<blockquote>
<p>查看bbox3的网卡变化</p>
</blockquote>
</li>
</ul>
</li>
<li><p>该容器有了三块网卡 14 和 18 是用来连接 ov_net1 和 ov_net2的网卡 16 是连接 本地自动创建的网卡的 这三个都是新创建的</p>
<pre><code class="hljs angelscript"><span class="hljs-string">[root@docker2 ~]</span># docker exec -it bbox3 ip a
<span class="hljs-number">1</span>: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu <span class="hljs-number">65536</span> qdisc noqueue qlen <span class="hljs-number">1000</span>
    link/loopback <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span> brd <span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>
    inet <span class="hljs-number">127.0</span><span class="hljs-number">.0</span><span class="hljs-number">.1</span>/<span class="hljs-number">8</span> scope host lo
       valid_lft forever preferred_lft forever
<span class="hljs-number">14</span>: <span class="hljs-symbol">eth0@</span>if15: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1450</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:<span class="hljs-number">0</span>a:<span class="hljs-number">00</span>:<span class="hljs-number">01</span>:<span class="hljs-number">02</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">10.0</span><span class="hljs-number">.1</span><span class="hljs-number">.2</span>/<span class="hljs-number">24</span> brd <span class="hljs-number">10.0</span><span class="hljs-number">.1</span><span class="hljs-number">.255</span> scope global eth0
       valid_lft forever preferred_lft forever
<span class="hljs-number">16</span>: <span class="hljs-symbol">eth1@</span>if17: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1500</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:ac:<span class="hljs-number">12</span>:<span class="hljs-number">00</span>:<span class="hljs-number">03</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">172.18</span><span class="hljs-number">.0</span><span class="hljs-number">.3</span>/<span class="hljs-number">16</span> brd <span class="hljs-number">172.18</span><span class="hljs-number">.255</span><span class="hljs-number">.255</span> scope global eth1
       valid_lft forever preferred_lft forever
<span class="hljs-number">18</span>: <span class="hljs-symbol">eth2@</span>if19: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu <span class="hljs-number">1450</span> qdisc noqueue 
    link/ether <span class="hljs-number">02</span>:<span class="hljs-number">42</span>:<span class="hljs-number">0</span>a:<span class="hljs-number">00</span>:<span class="hljs-number">00</span>:<span class="hljs-number">05</span> brd ff:ff:ff:ff:ff:ff
    inet <span class="hljs-number">10.0</span><span class="hljs-number">.0</span><span class="hljs-number">.5</span>/<span class="hljs-number">24</span> brd <span class="hljs-number">10.0</span><span class="hljs-number">.0</span><span class="hljs-number">.255</span> scope global eth2
       valid_lft forever preferred_lft forever</code></pre>
<h2 id="手动指定overlay网段"><a href="#手动指定overlay网段" class="headerlink" title="手动指定overlay网段"></a>手动指定overlay网段</h2><pre><code class="hljs routeros">[root@docker1 ~]# docker<span class="hljs-built_in"> network </span>create --driver overlay --subnet 10.22.1.0/24 --gateway 10.22.1.1 ov_net3
03a6a6ce682d4e911ea6f0ec328eb0efddd92f5724258f01bb4fb7d0c0acbdc6
[root@docker1 ~]# docker<span class="hljs-built_in"> network </span>inspect ov_net3
                    <span class="hljs-string">&quot;Subnet&quot;</span>: <span class="hljs-string">&quot;10.22.1.0/24&quot;</span>,</code></pre>
<h2 id="补充"><a href="#补充" class="headerlink" title="补充"></a>补充</h2></li>
<li><p>跨主机：消息能传到路由上（在物理网卡上联通，再传到路由上）</p>
</li>
<li><p>Docker network分为两种类型：本机通讯类型（none/host/bridge）</p>
</li>
<li><p>跨主机通讯类型：（macvlan/pverlay)</p>
<h2 id="跨主机通讯概念"><a href="#跨主机通讯概念" class="headerlink" title="跨主机通讯概念"></a>跨主机通讯概念</h2></li>
<li><p>前面已经有了 Docker 的几种网络方案：none、host、bridge 和 joined 容器，它们解决了单个 Docker主机内容器通信的问题。</p>
</li>
<li><p>libnetwork &amp; CNM</p>
<ul>
<li>libnetwork 是 docker 容器网络库，最核心的内容是其定义的 Container Network Model (CNM)，这个模型对容器网络进行了抽象，由以下三类组件组成：<blockquote>
<p>sandbox、endpoint、network</p>
</blockquote>
</li>
</ul>
</li>
<li><p>sandbox</p>
<ul>
<li>Sandbox 是容器的网络栈，包含容器的 interface、路由表和 DNS 设置。 Linux Network Namespace 是 Sandbox 的标准实现。Sandbox 可以包含来自不同 Network 的 Endpoint</li>
</ul>
</li>
<li><p>endpoint</p>
<ul>
<li>Endpoint 的作用是将 Sandbox 接入 Network。Endpoint 的典型实现是 veth pair，一个 Endpoint 只能属于一个网络，也只能属于一个 Sandbox。</li>
</ul>
</li>
<li><p>network</p>
<ul>
<li>Network 包含一组 Endpoint，同一 Network 的 Endpoint 可以直接通信。Network 的实现可以是 Linux Bridge、VLAN 等。<br><img src="/images/docker/kzj.png" srcset="/img/loading.gif"></li>
<li>如图所示两个容器，一个容器一个 Sandbox，每个 Sandbox 都有一个 Endpoint 连接到 Network，第二个 Sandbox 还有一个 Endpoint 将其接入 Network 2.</li>
<li>由network的概念知道，同一network的endpoint可以直接通信，也就是与图中network向量的三个endpoint的sandbox以及web1都能够通信，而network2连接的sandbox就不可以，因为network2只有一个endpoint</li>
</ul>
</li>
</ul>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/docker/">docker</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/docker/">docker</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">本博客所有文章是以学习为目的，如果有不对的地方可以一起交流沟通共同学习 邮箱:1248287831@qq.com！</p>
              
              
                <div class="post-prevnext row">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2020/12/11/docker-flannel%E7%BD%91%E7%BB%9C/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">docker-flannel</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2020/12/09/docker-machine/">
                        <span class="hidden-mobile">docker-machine</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div id="tocbot"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    
  </main>

  
    <a id="scroll-top-button" href="#" role="button">
      <i class="iconfont icon-arrowup" aria-hidden="true"></i>
    </a>
  

  
    <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
  

  

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <a href="https://space.bilibili.com/39165374" target="_blank" rel="nofollow noopener"><span>LMK</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
  </div>
  
  <div class="statistics">
    
    

    
      
        <!-- 不蒜子统计PV -->
        <span id="busuanzi_container_site_pv" style="display: none">
            总访问量 
            <span id="busuanzi_value_site_pv"></span>
             次
          </span>
      
      
        <!-- 不蒜子统计UV -->
        <span id="busuanzi_container_site_uv" style="display: none">
            总访客数 
            <span id="busuanzi_value_site_uv"></span>
             人
          </span>
      
    
  </div>


  

  
</footer>

<!-- SCRIPTS -->
<script  src="https://cdn.staticfile.org/jquery/3.4.1/jquery.min.js" ></script>
<script  src="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/js/bootstrap.min.js" ></script>
<script  src="/js/debouncer.js" ></script>
<script  src="/js/main.js" ></script>

<!-- Plugins -->


  
    <script  src="/js/lazyload.js" ></script>
  



  



  <script defer src="https://cdn.staticfile.org/clipboard.js/2.0.6/clipboard.min.js" ></script>
  <script  src="/js/clipboard-use.js" ></script>



  <script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>





  <script  src="https://cdn.staticfile.org/tocbot/4.11.1/tocbot.min.js" ></script>
  <script>
    $(document).ready(function () {
      var boardCtn = $('#board-ctn');
      var boardTop = boardCtn.offset().top;

      tocbot.init({
        tocSelector: '#tocbot',
        contentSelector: '#post-body',
        headingSelector: 'h1,h2,h3,h4,h5,h6',
        linkClass: 'tocbot-link',
        activeLinkClass: 'tocbot-active-link',
        listClass: 'tocbot-list',
        isCollapsedClass: 'tocbot-is-collapsed',
        collapsibleClass: 'tocbot-is-collapsible',
        collapseDepth: 0,
        scrollSmooth: true,
        headingsOffset: -boardTop
      });
      if ($('.toc-list-item').length > 0) {
        $('#toc').css('visibility', 'visible');
      }
    });
  </script>



  <script  src="https://cdn.staticfile.org/typed.js/2.0.11/typed.min.js" ></script>
  <script>
    var typed = new Typed('#subtitle', {
      strings: [
        '  ',
        "docker-overylay&nbsp;",
      ],
      cursorChar: "_",
      typeSpeed: 70,
      loop: false,
    });
    typed.stop();
    $(document).ready(function () {
      $(".typed-cursor").addClass("h2");
      typed.start();
    });
  </script>



  <script  src="https://cdn.staticfile.org/anchor-js/4.2.2/anchor.min.js" ></script>
  <script>
    anchors.options = {
      placement: "right",
      visible: "hover",
      
    };
    var el = "h1,h2,h3,h4,h5,h6".split(",");
    var res = [];
    for (item of el) {
      res.push(".markdown-body > " + item)
    }
    anchors.add(res.join(", "))
  </script>



  <script  src="/js/local-search.js" ></script>
  <script>
    var path = "/local-search.xml";
    var inputArea = document.querySelector("#local-search-input");
    inputArea.onclick = function () {
      searchFunc(path, 'local-search-input', 'local-search-result');
      this.onclick = null
    }
  </script>



  <script  src="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.css" />

  <script>
    $('#post img:not(.no-zoom img, img[no-zoom]), img[zoom]').each(
      function () {
        var element = document.createElement('a');
        $(element).attr('data-fancybox', 'images');
        $(element).attr('href', $(this).attr('src'));
        $(this).wrap(element);
      }
    );
  </script>















</body>
</html>
